event-emitter-testmetest

Details

**Severity:** Critical

**Affected versions:** `= 1.0.6`

event-emitter-testmetest was published by npm account `testnewtestme2` on 2026-10-21, first to test the delivery chain of data-pipeline-testmetest 2.0.1 and then to ship it. 1.0.6 and 1.0.7 ship an obfuscated `index.js` loader that decrypts a filler stage and pipes it into Bun with the full environment: 1.0.6 runs it on load, 1.0.7 on `npm install` via a `binding.gyp` source `<!(env node index.js >/dev/null 2>&1; echo stub.c)`. 4.1.0 and 5.0.0 ship rebuilds of the full stealer behind the same `binding.gyp` hook: inline in `index.js` in 4.1.0, and in an encrypted `data.bin` that `index.js` decrypts in 5.0.0. Other versions carry no executable payload.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/d00528d10daab38eadcbc9a9c17890a17aa25e95/osv/malicious/npm/event-emitter-testmetest/MAL-2026-18178.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/d00528d10daab38eadcbc9a9c17890a17aa25e95/osv/malicious/npm/event-emitter-testmetest/MAL-2026-18178.json
- https://www.npmjs.com/package/event-emitter-testmetest
- https://github.com/ossf/malicious-packages/blob/f17c406fb7ee5243da902499814340765fd9b86a/osv/malicious/npm/event-emitter-testmetest/MAL-2026-18178.json
- https://www.npmjs.com/package/event-emitter-testmetest/v/1.0.7
- https://www.npmjs.com/package/event-emitter-testmetest/v/4.1.0
- https://www.npmjs.com/package/event-emitter-testmetest/v/5.0.0
- https://github.com/advisories/GHSA-23vf-x9vg-87p2

Compromised versions (1)

• = 1.0.6

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.